policy-kyverno-config-exclude-resources.yaml

apiVersion: policy.open-cluster-management.io/v1
kind: Policy
metadata:
  name: policy-kyverno-config-exclude-resources
  annotations:
    policy.open-cluster-management.io/standards: NIST SP 800-53
    policy.open-cluster-management.io/categories: CM Configuration Management
    policy.open-cluster-management.io/controls: CM-2 Baseline Configuration
spec:
  remediationAction: enforce
  disabled: false
  policy-templates:
    - objectDefinition:
        apiVersion: policy.open-cluster-management.io/v1
        kind: ConfigurationPolicy
        metadata:
          name: policy-kyverno-config-exclude-resources
        spec:
          remediationAction: inform # will be overridden by remediationAction in parent policy
          severity: low
          object-templates:
            - complianceType: mustonlyhave
              objectDefinition:
                apiVersion: v1
                kind: ConfigMap
                metadata:
                  annotations:
                    meta.helm.sh/release-name: kyverno
                    meta.helm.sh/release-namespace: kyverno
                  labels:
                    app: kyverno
                    app.kubernetes.io/component: kyverno
                    app.kubernetes.io/instance: kyverno
                    app.kubernetes.io/managed-by: Helm
                    app.kubernetes.io/name: kyverno
                    app.kubernetes.io/part-of: kyverno
                    app.kubernetes.io/version: v2.1.2
                    helm.sh/chart: kyverno-v2.1.2
                  name: kyverno
                  namespace: kyverno
                data:       # specify all filters you need to exclude
                  resourceFilters: '[*,kyverno,*][Event,*,*][*,kube-system,*][*,kube-public,*][*,kube-node-lease,*][Node,*,*][APIService,*,*][TokenReview,*,*][SubjectAccessReview,*,*][SelfSubjectAccessReview,*,*][Binding,*,*][ReplicaSet,*,*][ReportChangeRequest,*,*][ClusterReportChangeRequest,*,*][ClusterRole,*,kyverno:*][ClusterRoleBinding,*,kyverno:*][ServiceAccount,kyverno,kyverno][ConfigMap,kyverno,kyverno][ConfigMap,kyverno,kyverno-metrics][Deployment,kyverno,kyverno][Job,kyverno,kyverno-hook-pre-delete][NetworkPolicy,kyverno,kyverno][PodDisruptionBudget,kyverno,kyverno][Role,kyverno,kyverno:*][RoleBinding,kyverno,kyverno:*][Secret,kyverno,kyverno-svc.kyverno.svc.*][Service,kyverno,kyverno-svc][Service,kyverno,kyverno-svc-metrics][ServiceMonitor,kyverno,kyverno-svc-service-monitor][Pod,kyverno,kyverno-test][*,openshift-*,*][*,open-cluster-*,*][*,stackrox,*][*,ansible-automation-platform,*][*,hive,*][*,multicluster-engine,*][*,rhacs-operator,*][*,local-quay,*]'
                  webhooks: '[{"namespaceSelector": {"matchExpressions": [{"key":"kubernetes.io/metadata.name","operator":"NotIn","values":["kyverno"]}]}}]'
---
apiVersion: policy.open-cluster-management.io/v1
kind: PlacementBinding
metadata:
  name: binding-policy-kyverno-config-exclude-resources
placementRef:
  name: placement-policy-kyverno-config-exclude-resources
  kind: PlacementRule
  apiGroup: apps.open-cluster-management.io
subjects:
  - name: policy-kyverno-config-exclude-resources
    kind: Policy
    apiGroup: policy.open-cluster-management.io
---
apiVersion: apps.open-cluster-management.io/v1
kind: PlacementRule
metadata:
  name: placement-policy-kyverno-config-exclude-resources
spec:
  clusterConditions:
    - status: "True"
      type: ManagedClusterConditionAvailable
  clusterSelector:
    matchExpressions:
      - {key: environment, operator: In, values: ["dev"]}